Policy & Compliance Manager (Cyber Essentials Lead)

beaumont; Tees Valley; On-site; GBP 55,000 - 75,000; Full time

Job summary

Unknown MSP is seeking a seasoned Cyber Essentials/CE+ engineer to own the certification program end‑to‑end. You’ll manage CE+ renewals, coordinate with a client base of 30–40 organisations, and shape how certification is scoped, priced and rolled out.

Reporting to Head of Technical, you’ll work with service desk, networks, projects and infrastructure, stay hands‑on, run vulnerability scans, report findings, and help develop a managed service offering as the security practice grows.

Qualifications

• Hands‑on experience delivering Cyber Essentials and CE+.
• A strong 3rd line background, or 2nd line readiness to step up.
• Good working knowledge of Windows Server, AD, Group Policy, M365, Azure, networking and firewalls.
• Confidence in front of clients and an eye for the commercial side of security.
• Kaseya experience would help, but it isn’t essential.

Responsibilities

• Own the Cyber Essentials and CE+ program end‑to‑end, including renewals and client management.
• Lead a client base of 30–40 organisations at different certification stages and define rollout approaches.
• Collaborate with service desk, networks, projects and infrastructure teams and stay hands‑on when needed.
• Grow vulnerability management activities: run scans, report findings and review pen test results at a high level.
• Help shape a managed security service as the practice expands.

Skills

Cyber Essentials

CE+

Windows Server

Active Directory

M365

Azure

Networking

Firewalls

Kaseya

Client facing

Tools

Kaseya

Job description

At a lot of MSPs, Cyber Essentials ends up with whichever strong 3rd line engineer knows it best. They scope it, chase the evidence, fix what needs fixing and get it over the line, usually on top of the day job and with little say in how it’s run. This role gives that person the whole thing to own.

An established MSP is bringing Cyber Essentials and CE+ in-house after years of relying on third parties to deliver it. They want one person to take ownership, starting with their own CE+ renewal and then working across a client base of 30 to 40 organisations, all at different stages of certification. Much of how it’s scoped, priced and rolled out to clients will be down to you.

You’ll report to the Head of Technical and work alongside the service desk, networks, projects and infrastructure teams. That means you’ll have engineers to hand config and remediation work to, and you’ll still get hands‑on when a job needs your experience. Your technical background is the reason you’d get this job, and you’ll use it every week.

There’s also a vulnerability management side to grow. You’ll run scans, report findings back to clients and review pen test results at a high level. The business wants to turn this into a managed service of its own, and whoever takes this seat will have a big hand in shaping it. If you’ve been looking for a way to move from infrastructure into security without starting again at the bottom, this is a good route in.

They’ll support you through certification as well, and CCEP is an obvious place to start.

What you’ll need:

• Hands‑on experience delivering Cyber Essentials and CE+
• A strong 3rd line background, or 2nd line experience at a level where you’re ready to step up
• Good working knowledge of Windows Server, AD, Group Policy, M365, Azure, networking and firewalls
• Confidence in front of clients, and an eye for the commercial side of security
• Kaseya experience would help, but it isn’t essential

Please note, this role is 5 days on site in Middlesbrough.